Overview
Bring Your Own Device (BYOD) allows users to install the Swif agent on personal devices for basic policy enforcement and visibility. However, Apple and Microsoft apply user-level enrollment constraints in a BYOD scenario, limiting what Swif can do remotely. This article outlines:
Windows BYOD limitations (e.g., no Swif Admin Account creation).
macOS BYOD limitations, particularly when enrolled via the Swif installer.
General Apple MDM constraints that apply to personal Apple devices.
1. Windows BYOD: No Swif Admin Account
When a Windows device is brought under BYOD, the Swif agent does not create a Swif Admin Account on that machine. In fully managed (corporate-owned) Windows devices, Swif can provision an admin account for remote troubleshooting and control. However, for BYOD scenarios, there is no elevated Swif Admin Account installed.
Implication:
IT admins cannot remotely access or manage the Windows device at an administrator level.
All configuration changes or software installations requiring administrative privileges remain under the user’s control.
2. Mac BYOD With Swif Installer
When a Mac user installs the Swif agent via the Swif installer (rather than through Automated Device Enrollment [ADE] or Apple Business Manager [ABM]), the device is registered in a limited, user-based enrollment mode. This enforces the following constraints:
One Profile Only
The Mac can receive and install one Swif policy profile after running the Swif installer.
No Remote Profile Updates or Removals
Once installed, the policy profile cannot be updated or removed remotely by Swif.
If you want to change or remove the profile, the user must do so locally (via System Settings > Profiles or System Preferences > Profiles).
Limited Control
Any new or modified policy from Swif will not override or delete the existing profile.
True “device management” features—like enforcing certain security settings or wiping the device—are not available unless you use a fully managed (e.g., ABM/ADE) enrollment method.
Note: By default, the Swif agent can still report on certain security posture checks and push the single profile during the initial enrollment. But for subsequent changes, user intervention is required.
3. Apple macOS MDM Hard Requirements
In addition to the BYOD-specific limitations, Apple imposes certain hard requirements for macOS MDM—particularly when the device is enrolled in a user-based or BYOD-like capacity. These include:
Disallow Passcode Removal
If a passcode (or password) policy is enforced, the user cannot remove it without first unenrolling or removing the profile.
Disallow Device Erasure
In a BYOD context, the MDM cannot issue a remote wipe or full device erasure. Such privileges are reserved for fully managed devices enrolled via ABM/ADE.
Disallow Security-Related Queries
In many BYOD cases, Apple restricts certain system-level queries, meaning the MDM agent cannot gather deep security info or run certain commands that might violate user privacy.
These restrictions are in place to protect user data privacy on personal devices, ensuring MDM solutions don’t overreach in a BYOD context.
Summary of Limitations & Best Practices
Windows BYOD:
No Swif Admin Account is created. The user retains full control over administrative tasks.
Remote support is limited to the basic functionalities Swif can provide.
Mac BYOD (Swif Installer):
Only one policy profile can be installed.
That installed profile cannot be updated or removed by Swif; user must remove it locally.
Fully managed Mac enrollments using ABM/ADE or user-approved MDM provide greater management and update capabilities.
macOS MDM Requirements (General):
Passcode removal, device erasure, and certain security queries are disallowed in user-based enrollment (BYOD).
For advanced management (remote wipe, deep security queries, etc.), you need a fully managed (corporate-owned) Mac enrollment.
Best Practices
Carefully Plan Profiles
For Mac BYOD, ensure the single policy profile pushed during install is as complete and future-proof as possible, since you can’t easily update it after deployment.
Encourage Corporate Enrollment for Company-Owned Devices
Use ABM/ADE enrollment or user-approved MDM for corporate Macs to allow full control (remote wipe, profile updates, deeper security checks).
Communicate to Users
Let BYOD users know that local device actions may be required to remove or update existing profiles, and that certain features (like remote wipe or admin-level controls) won’t be available.
Need Help?
If you have further questions on BYOD limitations, or if your device is corporate-owned and you’d like to transition to a fully managed scenario, please reach out to Swif Support or consult your IT admin.
These limitations help maintain user privacy and comply with Apple and Microsoft’s BYOD rules, but Swif continues to explore solutions to give admins as many capabilities as possible within each platform’s guidelines.